This article shows and explains the situation when the ARP reply packets leaving the APM can be transparently changed under certain circumstances.Symptoms:
1. "mac-usage vrrp-mac" is configured on circuit's virtual router
2. APM packet capture (tcpdump) shows that the ARP replies leaving the VRRP enabled circuit are carrying circuit MAC address instead of the (expected) VRRP MAC address. This is then transparently changed and NPM is already showing the expected VRRP MAC address.
| Source MAC | ARP reply payload | |
|---|---|---|
| APM capture | 00:03:d2:f1:01:01 | 10.1.1.1 is at 00:03:d2:f1:01:01 |
| NPM capture | 00:00:5e:00:00:01 | 10.1.1.1 is at 00:00:5e:00:00:01 |
Goal:
To explain this behavior.
The observed behavior does not mean a problem and is purely cosmetic. The reason for it is that under certain circumstances the ARP replies for the ARP requests hitting the circuit's VRRP IP are changed by the VND driver after the packet is captured by the tcpdump. This causes the difference between the APM and NPM packet capture output.